OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Vuln-Dev Archives: Re: Secure coding in C (was Re: Administrivi

Re: Secure coding in C (was Re: Administrivia #4883)

Subject: Re: Secure coding in C (was Re: Administrivia #4883)
From: Craig H. Rowland (crowlandCISCO.COM)
Date: Mon Jan 17 2000 - 13:44:24 CST

> Brian Masney wrote:
> >
> > > ] char *a = something();
> > > ] char *b = something_else();
> > > ] int len = strlen(a) + strlen(b);
> > > ] char *c = malloc(len + 1) || die("malloc");
> > > ] (void) strcat(strcpy(c, a), b);
>
> I'm partial to strncpy(); strcpy is a known hobgoblin to secure
programming.

strncpy() has its problems too (i.e. it doesn't null terminate if the src is
too long). I wrote my own SafeStrncpy() function but I think a better choice
is the strlcpy() and strlcat() functions that come with OpenBSD. Theo
DeRaadt has a presentation on this as well. You should search the OpenBSD
site and source tree for more information. The strlcpy() and strlcat()
functions take care of a lot of nonsense present in the default C string
handling libraries.

-- Craig

This archive was generated by hypermail 2b27 : Mon Jan 17 2000 - 22:19:53 CST